Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 20:18
Static task
static1
Behavioral task
behavioral1
Sample
069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe
Resource
win10v2004-20230220-en
General
-
Target
069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe
-
Size
868KB
-
MD5
f9708e5351d3eca278ff3ab3b382068d
-
SHA1
f9dc91630caaff42de68d9e1fba1ef27429e7e96
-
SHA256
069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c
-
SHA512
3d9f9bd5c7a8c98d848ab24d53ae7eae1ece58e5a7f557aff904c176e61de15602434c1dcad4d9e9a395a5f9531d6fcc3bf15bcd7eda34de8e18f6768eb988e3
-
SSDEEP
24576:Qy5ixeVzvf/8c+ot+CJTBNA3imJgfgOBoe:X5iOrcfAdlNuJg
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 1768 y50990572.exe 432 p18402070.exe 1568 1.exe 1632 r43551525.exe -
Loads dropped DLL 9 IoCs
pid Process 1756 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe 1768 y50990572.exe 1768 y50990572.exe 1768 y50990572.exe 432 p18402070.exe 432 p18402070.exe 1568 1.exe 1768 y50990572.exe 1632 r43551525.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y50990572.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y50990572.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 432 p18402070.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1756 wrote to memory of 1768 1756 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe 28 PID 1756 wrote to memory of 1768 1756 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe 28 PID 1756 wrote to memory of 1768 1756 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe 28 PID 1756 wrote to memory of 1768 1756 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe 28 PID 1756 wrote to memory of 1768 1756 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe 28 PID 1756 wrote to memory of 1768 1756 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe 28 PID 1756 wrote to memory of 1768 1756 069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe 28 PID 1768 wrote to memory of 432 1768 y50990572.exe 29 PID 1768 wrote to memory of 432 1768 y50990572.exe 29 PID 1768 wrote to memory of 432 1768 y50990572.exe 29 PID 1768 wrote to memory of 432 1768 y50990572.exe 29 PID 1768 wrote to memory of 432 1768 y50990572.exe 29 PID 1768 wrote to memory of 432 1768 y50990572.exe 29 PID 1768 wrote to memory of 432 1768 y50990572.exe 29 PID 432 wrote to memory of 1568 432 p18402070.exe 30 PID 432 wrote to memory of 1568 432 p18402070.exe 30 PID 432 wrote to memory of 1568 432 p18402070.exe 30 PID 432 wrote to memory of 1568 432 p18402070.exe 30 PID 432 wrote to memory of 1568 432 p18402070.exe 30 PID 432 wrote to memory of 1568 432 p18402070.exe 30 PID 432 wrote to memory of 1568 432 p18402070.exe 30 PID 1768 wrote to memory of 1632 1768 y50990572.exe 31 PID 1768 wrote to memory of 1632 1768 y50990572.exe 31 PID 1768 wrote to memory of 1632 1768 y50990572.exe 31 PID 1768 wrote to memory of 1632 1768 y50990572.exe 31 PID 1768 wrote to memory of 1632 1768 y50990572.exe 31 PID 1768 wrote to memory of 1632 1768 y50990572.exe 31 PID 1768 wrote to memory of 1632 1768 y50990572.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe"C:\Users\Admin\AppData\Local\Temp\069896700f5dc9d4f3944a98a786fbf709aa5ee4c3cd57846afa9fa086950a6c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y50990572.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y50990572.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p18402070.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p18402070.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r43551525.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r43551525.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
578KB
MD5e49edb01c69239a72175377024280816
SHA160aabc1892d89662f5f9ca08e9325a7b57a1043f
SHA256861387c39781bd8e1f952b989586dd78fd0cdaa996a691a04741c62a0fb70200
SHA512fdeb6abac5dc186624adfcd7b3ebe4a5e6ae231375341117a330d3038dde6c480bda58692908f88871d8a4cad36ecd7ec7ffa9cac181916134488149f13e802a
-
Filesize
578KB
MD5e49edb01c69239a72175377024280816
SHA160aabc1892d89662f5f9ca08e9325a7b57a1043f
SHA256861387c39781bd8e1f952b989586dd78fd0cdaa996a691a04741c62a0fb70200
SHA512fdeb6abac5dc186624adfcd7b3ebe4a5e6ae231375341117a330d3038dde6c480bda58692908f88871d8a4cad36ecd7ec7ffa9cac181916134488149f13e802a
-
Filesize
580KB
MD50ebb902ee8c26254540e35300be4dcd0
SHA15dc8b70321806547021cf70caa51174d2cc17ec0
SHA2560066765a14fc86229a990662cb9575f20134396155fcdc1aa5cae200192f786a
SHA512d4f3d90ec0360b5ed3c3bb8e1ec45e07c27618d9014f98a1c30bef89dd63133792cb38d9eda442fc3cc1a7a6ae84b28bbaf8ac0de6d927b0ca1c0ada11444789
-
Filesize
580KB
MD50ebb902ee8c26254540e35300be4dcd0
SHA15dc8b70321806547021cf70caa51174d2cc17ec0
SHA2560066765a14fc86229a990662cb9575f20134396155fcdc1aa5cae200192f786a
SHA512d4f3d90ec0360b5ed3c3bb8e1ec45e07c27618d9014f98a1c30bef89dd63133792cb38d9eda442fc3cc1a7a6ae84b28bbaf8ac0de6d927b0ca1c0ada11444789
-
Filesize
580KB
MD50ebb902ee8c26254540e35300be4dcd0
SHA15dc8b70321806547021cf70caa51174d2cc17ec0
SHA2560066765a14fc86229a990662cb9575f20134396155fcdc1aa5cae200192f786a
SHA512d4f3d90ec0360b5ed3c3bb8e1ec45e07c27618d9014f98a1c30bef89dd63133792cb38d9eda442fc3cc1a7a6ae84b28bbaf8ac0de6d927b0ca1c0ada11444789
-
Filesize
172KB
MD5a97d64f7e68846305f56997c5e3f893d
SHA1886bc45bd2949dcec3ad6cf96dd678970bdd6a7c
SHA2565e0c3e9cd15e44bd1502a1bd6683804a8977ff47188db98821a7953270308658
SHA5120ee7c3236cbe40f4bfbd586430890272efc96d55bf464866d9ce2d691c7f10139ce45516c45c0da6cc1e34360f7098b7218254de41154a22cb1211332acbe682
-
Filesize
172KB
MD5a97d64f7e68846305f56997c5e3f893d
SHA1886bc45bd2949dcec3ad6cf96dd678970bdd6a7c
SHA2565e0c3e9cd15e44bd1502a1bd6683804a8977ff47188db98821a7953270308658
SHA5120ee7c3236cbe40f4bfbd586430890272efc96d55bf464866d9ce2d691c7f10139ce45516c45c0da6cc1e34360f7098b7218254de41154a22cb1211332acbe682
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
578KB
MD5e49edb01c69239a72175377024280816
SHA160aabc1892d89662f5f9ca08e9325a7b57a1043f
SHA256861387c39781bd8e1f952b989586dd78fd0cdaa996a691a04741c62a0fb70200
SHA512fdeb6abac5dc186624adfcd7b3ebe4a5e6ae231375341117a330d3038dde6c480bda58692908f88871d8a4cad36ecd7ec7ffa9cac181916134488149f13e802a
-
Filesize
578KB
MD5e49edb01c69239a72175377024280816
SHA160aabc1892d89662f5f9ca08e9325a7b57a1043f
SHA256861387c39781bd8e1f952b989586dd78fd0cdaa996a691a04741c62a0fb70200
SHA512fdeb6abac5dc186624adfcd7b3ebe4a5e6ae231375341117a330d3038dde6c480bda58692908f88871d8a4cad36ecd7ec7ffa9cac181916134488149f13e802a
-
Filesize
580KB
MD50ebb902ee8c26254540e35300be4dcd0
SHA15dc8b70321806547021cf70caa51174d2cc17ec0
SHA2560066765a14fc86229a990662cb9575f20134396155fcdc1aa5cae200192f786a
SHA512d4f3d90ec0360b5ed3c3bb8e1ec45e07c27618d9014f98a1c30bef89dd63133792cb38d9eda442fc3cc1a7a6ae84b28bbaf8ac0de6d927b0ca1c0ada11444789
-
Filesize
580KB
MD50ebb902ee8c26254540e35300be4dcd0
SHA15dc8b70321806547021cf70caa51174d2cc17ec0
SHA2560066765a14fc86229a990662cb9575f20134396155fcdc1aa5cae200192f786a
SHA512d4f3d90ec0360b5ed3c3bb8e1ec45e07c27618d9014f98a1c30bef89dd63133792cb38d9eda442fc3cc1a7a6ae84b28bbaf8ac0de6d927b0ca1c0ada11444789
-
Filesize
580KB
MD50ebb902ee8c26254540e35300be4dcd0
SHA15dc8b70321806547021cf70caa51174d2cc17ec0
SHA2560066765a14fc86229a990662cb9575f20134396155fcdc1aa5cae200192f786a
SHA512d4f3d90ec0360b5ed3c3bb8e1ec45e07c27618d9014f98a1c30bef89dd63133792cb38d9eda442fc3cc1a7a6ae84b28bbaf8ac0de6d927b0ca1c0ada11444789
-
Filesize
172KB
MD5a97d64f7e68846305f56997c5e3f893d
SHA1886bc45bd2949dcec3ad6cf96dd678970bdd6a7c
SHA2565e0c3e9cd15e44bd1502a1bd6683804a8977ff47188db98821a7953270308658
SHA5120ee7c3236cbe40f4bfbd586430890272efc96d55bf464866d9ce2d691c7f10139ce45516c45c0da6cc1e34360f7098b7218254de41154a22cb1211332acbe682
-
Filesize
172KB
MD5a97d64f7e68846305f56997c5e3f893d
SHA1886bc45bd2949dcec3ad6cf96dd678970bdd6a7c
SHA2565e0c3e9cd15e44bd1502a1bd6683804a8977ff47188db98821a7953270308658
SHA5120ee7c3236cbe40f4bfbd586430890272efc96d55bf464866d9ce2d691c7f10139ce45516c45c0da6cc1e34360f7098b7218254de41154a22cb1211332acbe682
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf